Background

[0001 ] This relates generally to event data recorders and particularly to event data recorders for vehicles.

[0002] Event data recorders are well known on airplanes. Typically the event data recorders are called black boxes and are used by accident investigators to determine the cause of airplane accidents. It has also been contemplated that event data recorders may be included in motor vehicles. One aim of these event data recorders may be very similar to those in airplanes, namely crash analysis.

[0003] The National Highway Transport Safety Administration has mandated that all light vehicles in the United States manufactured after September 1 , 201 2 include an event data recorder that records a minimum set of data elements. The electronic data recorders typically store data for a few seconds prior and after unusual events in the car electronic systems.

[0004] Current event data recorders under development are proprietary, closed systems often implemented by a system-on-a-chip which records a limited data set coming from the control area network bus of the vehicle. Retrieving data from event data recorders is a cumbersome process, that requires trained professionals connecting proprietary equipment to read out the data.

Brief Description Of The Drawings

[0005] Figure 1 is a system depiction for one embodiment to the present invention;

[0006] Figure 2 is a flowchart for peripherals in accordance with one embodiment to the present invention;

[0007] Figure 3 is a flowchart for a black box driver in accordance with one embodiment of the present invention; and [0008] Figure 4 is a flowchart for a secure hardware element according to one embodiment to the present invention.

Detailed Description

[0009] In accordance with some embodiments, in response to the detection of a particular event, an event data recorder may enter a secure mode. In the secure mode, data from various peripherals is collected over a secure channel and stored in a secure memory within the event data recorder. That data may subsequently be read out under secure conditions with an assurance of reliability. While the system is in a secure mode, it may continue to collect data in a non-secure mode in parallel.

[0010] Referring to Figure 1 , an in-vehicle infotainment ( I I) platform 10 is depicted. While in some embodiments, the present invention may be implemented as part of an in-vehicle infotainment system, in other embodiments, it may be implemented as a dedicated electronic data recorder or may be integrated into existing automotive microcontrollers.

[001 1 ] Microcontrollers in electronic control units in existing vehicles

communicate with each other through a controller area network (CAN) bus. All messages pertaining to the vehicle, such as door status, engine, and alarm status are carried by this bus. In-vehicle infotainment platforms connect to the CAN bus through a CAN interface. A CAN driver decodes the data from the CAN bus and provides it to a host central processing unit.

[0012] In Figure 1 , the in-vehicle infotainment platform 10 includes host software 12 and a central processing unit (CPU)/peripheral component hub (PCH) 52. Also contained within the platform 10 is a secure hardware element 14. A memory 1 6 may be accessible by the central processing unit/peripheral component hub 52 in some embodiments. Of course other architectures are also contemplated. In some embodiments, an open system is implemented that can be accessed without proprietary tools.

[0013] The host software 1 2 may include a variety of host software applications 20, a black box driver 22, a video driver 24, a global positioning system driver 26, a CAN driver 28 and an event data recorder driver 30. Each of the drivers 24 through 30 receives messages from the driver 22 and sends those messages to peripheral devices such as the video peripheral device 34, the global positioning system (GPS) peripheral device 36, the CAN peripheral device 38 and the event data recorder 40. Each of the peripheral devices may include a memory 54. In some embodiments, a memory may be a circular buffer that gets periodically rewritten so that it only records information for a predetermined amount of time before it is refreshed.

[0014] In some embodiments data collection may be triggered by an event. For example alarm 44 may issue an alarm in response to an unusual situation and in response, data may be collected. For example when a sudden acceleration is sensed, data collection may be triggered.

[0015] Thus in some embodiments, the provision of the buffer 54 allows automatic provision of data collected during a predetermined amount of time before the triggering event. In addition data after the event may be automatically collected. Thus in some embodiments, the amount of pre-event data may be determined by the size of the buffer and the amount of post-event data, that is provided may be determined by programmed time limitations.

[0016] Each of the peripheral devices 1 8 may be connected to an actual peripheral such as a camera 42, an alarm 44, sensors 46, an electronic control unit 48 or an advanced driver assistance system (ADAS) 50. The GPS device 36 may be its own sensor.

[0017] Within the secure hardware element 14 may be black box application software 32 executed by the secure hardware element 14. Generally the secure hardware element 14 may be a secure microcontroller or a secure processor that is independent from the platform 10 processor. For example, it may be an

manageability processor or a processor for executing a secure environment. Such processors limit access to only certain applications and generally do not permit access by host software applications 20. This provides a secure environment which is less amenable to attack by outside software based attackers. [0018] While the peripheral devices are generally shown as being connected to the IVI platform 10, they may also connect through the CAN bus 38.

[0019] Data from the CAN bus 38 and the other peripherals 1 8 is decoded by a corresponding driver in the platform 10. Thus video is decoded by the video driver 24, GPS sensor data is decoded by the GPS driver 26, CAN data is decoded by the CAN driver 28 and event data recorder data is decoded by the event data recorder driver 30. After decoding, the data is then made available to the host application's 20 as indicated by the arrows labeled peripheral data.

[0020] The platform 10 may perform a black box or electronic data recorder functionality with secure and tamper resistant collection and storage of data from peripherals. This functionality may advantageously be performed in a hardware layer such as the secure hardware element 14 in some embodiments, since software components may be exposed to security threats like hacking, malware, and other compromises.

[0021 ] Each of the peripheral devices 1 8 from which data is collected may have two modes of operation including a normal and a secure mode. The normal mode is a regular operation of the peripheral device where it sends data to the host. In the secure mode, the peripheral device continues sending data, in the normal mode, but additionally signs another copy of the data and sends it to the host through a secure channel, labeled "secure channel" in Figure 1 .

[0022] The peripheral devices 18 have additional memory or buffer 54 to store data. The secure memory 54 can be a circular buffer which gets rewritten. The secure memory retrieved data prior to any unusual events and for some period afterwards. The amount of memory needed depends on the data that is generated by a particular peripheral device and the amount of history data that may be desirable.

[0023] Thus referring to Figure 2, a peripheral sequence 60 may be implemented in software, firmware, and/or hardware. In software and firmware embodiments it may be implemented by computer executed instructions stored in a non-transitory computer readable medium such as a magnetic, optical or semiconductor storage. In some cases, the sequence may be implemented onboard each peripheral itself using an onboard controller and storage.

[0024] The sequence 60, shown in Figure 2 begins by storing collected data in normal mode as indicated in block 62. Each peripheral sends a copy of the data to the host software 1 2 via one of the drivers 24 through 30 as indicated in block 64.

[0025] A check at diamond 66 determines whether a secure mode message has been received. The secure mode message may be sent in response to determining that a particular event has occurred that triggers electronic data recording. If such a message has been received, as determined in diamond 66, a secure channel is established (block 68) with a secure hardware element 14. The secure channel is indicated by the words "secure channel" in Figure 1 . Next the peripheral sends the data to the secure hardware element over the secured channel as indicated in block 70. The first "chunk" of data that is sent to the secure element is the data from the memory buffer, i.e. data leading to the "event" and additional data is collected after the event until the timer expires in one embodiment.

[0026] Thereafter a check at diamond 72 determines whether a predefined data collection time has expired for that peripheral device. The data collection time may be a function of the amount of data that is needed and may be different for every peripheral device. If not, the data continues to be collected and sent as indicated by the no prong from the diamond 72. Otherwise, if the collection time has expired, then that peripheral returns to only the normal mode as indicated in block 74.

[0027] Moving to Figure 3, a sequence 80 for the black box driver 22 (shown in Figure 1 ) is shown in Figure 3. The sequence 80 may be implemented in software, firmware and/or hardware. In software and firmware embodiments it may be implemented by computer executed instructions stored in a non-transitory computer readable medium such as an optical, magnetic or semiconductor storage. The black box driver may be stored within the platform 10 in a suitable memory or as part of its processing device in some embodiments. [0028] The sequence 80 begins with the black box driver registering with each of the plurality of peripherals in order to get data from those peripherals under particular circumstances, as indicated in block 82. Upon the occurrence of a preordained event, detected in diamond 84, the black box driver sends a message to each of the peripherals to trigger those peripherals to enter the secure mode that correlates to the event data recording, as indicated in block 86. It is contemplated that in response to some of events only certain peripherals may be triggered to enter the secure mode while other peripherals do not enter the secure mode.

[0029] Instead of using the black box driver 22, a hardware element or sensor such as alarm 44 may turn on and off the secure mode.

[0030] The secure hardware element 14 sequence 90, shown in Figure 4, may be implemented in hardware, software and/or firmware 14 (Figure 1 ). In software and firmware embodiments it may be implemented by computer executed

instructions stored in a non-transitory computer readable medium such as an optical, magnetic or semiconductor storage. In some embodiments a hardware implemented sequence 90 may be advantageous as it is less prone to software based attacks.

[0031 ] The sequence 90 begins by collecting data from the peripherals which are collecting the data in the secure mode as indicated in block 92. As the data is received, it is encrypted and signed as indicated in block 94. Finally the encrypted and signed data is stored in a secure memory associated with the hardware element 14 as indicated in block 96. Thereafter, the data may be extracted using the appropriate access privileges. The extracted data is event data to implement an event data recording application.

[0032] References throughout this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one implementation encompassed within the present invention. Thus, appearances of the phrase "one embodiment" or "in an embodiment" are not necessarily referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be instituted in other suitable forms other than the particular embodiment illustrated and all such forms may be encompassed within the claims of the present application.

[0033] While the present invention has been described with respect to a limited number of embodiments, those skilled in the art will appreciate numerous

modifications and variations therefrom. It is intended that the appended claims cover all such modifications and variations as fall within the true spirit and scope of this present invention.